Description
Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data, which triggers heap memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:1.4.1~git20080517-2 | — |
| Debian 13 | xorg-server | 2:1.4.1~git20080517-2 | — |
| Debian 12 | xorg-server | 2:1.4.1~git20080517-2 | — |
| Debian 5.0 | xorg-server | 2:1.4.1~git20080517-2~lenny1 | DTSA-141-1 |
| Debian 4.0 | xorg-server | 2:1.1.1-21etch5 | DSA-1595-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xorg-x11-server +6 | 1.1.1-48.41.el5_2.1 | RHSA-2008:0504 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xorg-x11-server | 1.20.13-1.2 | openSUSE-SU-2024:11525-1 |
Advisories 4
- RHSA-2008:0504 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1595-1 xorg-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-141-1 xorg-server - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11525-1 xorg-x11-server-1.20.13-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://issues.rpath.com/browse/RPL-2607
- 29670 vdb-entry
- 238686 vendor-advisory
- 33937 third-party-advisory
- 30664 third-party-advisory
- 20080621 rPSA-2008-0201-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 31025 third-party-advisory
- oval:org.mitre.oval:def:11246 vdb-entry signature
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- ADV-2008-1833 vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0201
- GLSA-200806-07 vendor-advisory
- 30715 third-party-advisory
- 30666 third-party-advisory
- 30627 third-party-advisory
- 30637 third-party-advisory
- MDVSA-2008:116 vendor-advisory
- 1020245 vdb-entry
- ADV-2008-1803 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2008-249.htm
- SUSE-SA:2008:027 vendor-advisory
- 30772 third-party-advisory
- 20080611 Multiple Vendor X Server Render Extension Gradient Creation Integer Overflow Vulnerability third-party-advisory
- 30659 third-party-advisory
- 31109 third-party-advisory
- ADV-2008-1983 vdb-entry
- 30671 third-party-advisory
- 30809 third-party-advisory
- MDVSA-2008:179 vendor-advisory
- [xorg] 20080611 X.Org security advisory june 2008 - Multiple vulnerabilities in X server extensions mailing-list
- RHSA-2008:0504 vendor-advisory
- 30843 third-party-advisory
- DSA-1595 vendor-advisory
- USN-616-1 vendor-advisory
- 32099 third-party-advisory
- https://issues.rpath.com/browse/RPL-2619
- SUSE-SR:2008:019 vendor-advisory
- 20080620 rPSA-2008-0200-1 xorg-server mailing-list
- 30630 third-party-advisory
- GLSA-200807-07 vendor-advisory